Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for srvx. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 1.0.7 | No known advisory | |
| 0.12.8 | No known advisory | |
| 0.11.22 | Safe from 0.11.13 | |
| 0.10.1 | 1 open advisory, worst moderate | |
| 0.9.8 | 1 open advisory, worst moderate | |
| 0.8.16 | 9 open advisories, worst moderate · last release Oct 2025, no longer updated |
- Moderatesrvx is vulnerable to middleware bypass via absolute URI in request line GHSA-p36q-q72m-gchr · 26 Mar 2026
- 0.11.x0.11.0 – 0.11.12Fixed in 0.11.13
- 0.10.x0.10.0 – 0.10.1No fix on 0.10.x · move to 0.11.13
- 0.9.x0.9.0 – 0.9.8No fix on 0.9.x · move to 0.11.13
- 0.8.x and older0.0.0 – 0.8.16No fix, no longer updated · move to 0.11.13
Registry facts last checked 26 Oct 2026. Releases and advisories last read 26 Oct 2026.